3 ms·

> 12. By this time, we had isolated the app and were convinced that this is the one that is fetching the image on startup. We could not find the image anywhere

by 4cao 6y ago

> 12. By this time, we had isolated the app and were convinced that this is the one that is fetching the image on startup. We could not find the image anywhere in the app, confirming our theory that it fetches the image but does not display it. The analysis stops right when things start to become interesting. I was hoping there'd be a decompiled code snippet to see what the app in question is actually doing with the image, since it's not displaying it.

inopinatus 6y ago
Evidently the download has been specially crafted and surreptitiously emplaced to globally disseminate a steganographically embedded key that decrypts tailored malware aimed at disrupting the [REDACTED] nuclear weapons programme and for which the app is a weaponised delivery sabot distributed and marketed as part of the same covert operation. What I'm trying to say is, the image is a plant
- 4cao 6y ago
  > What I'm trying to say is [...] Since you seem to be responding to me, how does anything you wrote relate to anything I wrote?
  - rob74 6y ago
    It's usually not a good idea to explain a joke, and I'm not the GP so I'm not sure that's what they meant, but "plant" has multiple meanings, and I suspect they are referring to meanings 3 to 5 from this list: https://www.oxfordlearnersdictionaries.com/definition/american_english/plant_2 https://www.oxfordlearnersdictionaries.com/definition/americ... . Basically, you were asking for some kind of elaborate meaning to a random image downloaded by a random app, and they provided an elaborate conspiracy theory to match your question...
    - 4cao 6y ago
      Thanks, I appreciate your effort but there really isn't any need to explain this to me. I understood the parent comment this way too (i.e. as a snide remark trying way too hard to be funny in the worst possible, low effort, Reddit kind of way). It's just that since it's rare to see this kind of response here, I was wondering if the author was trying to make any finer point, although admittedly that was unlikely to begin with. > Basically, you were asking for some kind of elaborate meaning to a random image downloaded by a random app [...] Basically, since they already traced the culprit with a lot of effort (as opposed to just blocking the request URL/UA string pair, which was also an option), the logical ultimate step to conclude their investigation should be to see what the code does, especially considering it's trivial to do so. While I would not expect to discover any "elaborate meaning" behind it, and never claimed anything like that, I certainly think it would be prudent to check what was going on if I had to decide what to do about it next. For example, it could have been intended as some proxy/filtering/DPI check. I've also seen similar stuff before incorporated into some custom Android builds to generate fake ad traffic. It really beggars belief that on a website called _Hacker_ News it's necessary to explain why sometimes it's worth it to be curious to people who themselves were curious enough to read this story and the associated comments but then halfway through decided their curiosity was satisfied and thus nobody else should be asking any more questions either (to be clear, I'm referring to the parent commenter here).
      - zymhan 6y ago
        Lol, I don't think you got the joke if you needed a paragraph long explanation of why you don't think it's funny. It's also okay to not get a joke, you can simply move on with your life.
      - jhamilton 6y ago
        Heaven forbid someone make a joke on the internet and not take your frustrations as seriously as you seem to take yourself. To address your frustration at the analysis stopping there: What do you expect someone who is likely more versed in web dev and their unique distributed systems to do? Do you expect them to have the expertise to decompile an app from a third party, an app popular enough to cause this much traffic? And if they did, would it be worthwhile when their only concern is limiting/lowering that traffic?
biased_coin 6y ago
If one were to decompile and check what the app is doing, I'd guess it would still be a good idea to not say so on a public forum. Especially, in cases where there is so much public attention. :)
- 4cao 6y ago
  I agree with what you're saying about not going public immediately if anything malicious had been discovered, but then they probably wouldn't have written: > We will thus hold back the banning of the url for now [...] If on the other hand it's really just some benign leftover example code downloading the image and not doing anything with it later as has been suggested and is indeed the most likely, there'd be no harm in confirming that's the case. They went to great lengths with their investigation, and this would be the obvious final step to wrap it up. Posting a couple of the relevant .smali lines wouldn't have to reveal the name of the app in question (which at this point can be identified by anyone sufficiently motivated anyway).

by 4cao 6y ago

inopinatus 6y ago

Evidently the download has been specially crafted and surreptitiously emplaced to globally disseminate a steganographically embedded key that decrypts tailored malware aimed at disrupting the [REDACTED] nuclear weapons programme and for which the app is a weaponised delivery sabot distributed and marketed as part of the same covert operation. What I'm trying to say is, the image is a plant

4cao 6y ago
> What I'm trying to say is [...] Since you seem to be responding to me, how does anything you wrote relate to anything I wrote?
- rob74 6y ago
  It's usually not a good idea to explain a joke, and I'm not the GP so I'm not sure that's what they meant, but "plant" has multiple meanings, and I suspect they are referring to meanings 3 to 5 from this list: https://www.oxfordlearnersdictionaries.com/definition/american_english/plant_2 https://www.oxfordlearnersdictionaries.com/definition/americ... . Basically, you were asking for some kind of elaborate meaning to a random image downloaded by a random app, and they provided an elaborate conspiracy theory to match your question...
  - 4cao 6y ago
    Thanks, I appreciate your effort but there really isn't any need to explain this to me. I understood the parent comment this way too (i.e. as a snide remark trying way too hard to be funny in the worst possible, low effort, Reddit kind of way). It's just that since it's rare to see this kind of response here, I was wondering if the author was trying to make any finer point, although admittedly that was unlikely to begin with. > Basically, you were asking for some kind of elaborate meaning to a random image downloaded by a random app [...] Basically, since they already traced the culprit with a lot of effort (as opposed to just blocking the request URL/UA string pair, which was also an option), the logical ultimate step to conclude their investigation should be to see what the code does, especially considering it's trivial to do so. While I would not expect to discover any "elaborate meaning" behind it, and never claimed anything like that, I certainly think it would be prudent to check what was going on if I had to decide what to do about it next. For example, it could have been intended as some proxy/filtering/DPI check. I've also seen similar stuff before incorporated into some custom Android builds to generate fake ad traffic. It really beggars belief that on a website called _Hacker_ News it's necessary to explain why sometimes it's worth it to be curious to people who themselves were curious enough to read this story and the associated comments but then halfway through decided their curiosity was satisfied and thus nobody else should be asking any more questions either (to be clear, I'm referring to the parent commenter here).
    - zymhan 6y ago
      Lol, I don't think you got the joke if you needed a paragraph long explanation of why you don't think it's funny. It's also okay to not get a joke, you can simply move on with your life.
    - jhamilton 6y ago
      Heaven forbid someone make a joke on the internet and not take your frustrations as seriously as you seem to take yourself. To address your frustration at the analysis stopping there: What do you expect someone who is likely more versed in web dev and their unique distributed systems to do? Do you expect them to have the expertise to decompile an app from a third party, an app popular enough to cause this much traffic? And if they did, would it be worthwhile when their only concern is limiting/lowering that traffic?

biased_coin 6y ago

If one were to decompile and check what the app is doing, I'd guess it would still be a good idea to not say so on a public forum. Especially, in cases where there is so much public attention. :)

4cao 6y ago
I agree with what you're saying about not going public immediately if anything malicious had been discovered, but then they probably wouldn't have written: > We will thus hold back the banning of the url for now [...] If on the other hand it's really just some benign leftover example code downloading the image and not doing anything with it later as has been suggested and is indeed the most likely, there'd be no harm in confirming that's the case. They went to great lengths with their investigation, and this would be the obvious final step to wrap it up. Posting a couple of the relevant .smali lines wouldn't have to reveal the name of the app in question (which at this point can be identified by anyone sufficiently motivated anyway).